Missing Hazards in the Risk File: ISO 14971 Lessons From the Olympus Warning Letter

In October 2026, FDA sent Olympus Medical Systems one of the most detailed device warning letters in recent memory, covering six manufacturing sites across Japan, Germany and the United States. Buried in the first finding is a sentence that should stop any quality or regulatory leader. For one surgical insufflator, catastrophic hazards including air embolism, arrhythmia and patient death were identified, but the risk management report did not reflect them, and design validation did not simulate the worst case. The hazards were known. They simply never made it into the file that is supposed to control them.

This is the quiet failure mode of medical device risk management. Not that hazards are missed, but that they are identified and then lost, never carried through to risk controls, design validation and the instructions for use. ISO 14971 exists to prevent exactly that. This article uses the Olympus warning letter to show what a defensible risk management file looks like, where real companies fall short, and what Canadian device makers must do to satisfy Health Canada, FDA and notified bodies. For the multi site CAPA governance angle on the same letter, see our companion analysis of the Olympus CAPA oversight findings.

Executive Summary

The findings were cited under the Quality System Regulation in force at the time of inspection. Corrective action now falls under the QMSR, which incorporates ISO 13485 by reference. Either way, the expectation is the same: identified hazards must drive risk controls, and real world data must keep the risk file current.

What a Risk Management File Is Under ISO 14971

A risk management file is the complete record of how a manufacturer identifies hazards, estimates and evaluates risk, controls it, and keeps that assessment current throughout the product's life. ISO 14971:2019, Medical devices, Application of risk management to medical devices, is the internationally recognized standard for this process. FDA recognizes it as a consensus standard, and it underpins the risk requirements in ISO 13485 and the QMSR. A risk management file is not a single document. It is the traceable thread from each hazard to its control and its verification.

ISO 14971 sets out a defined process. Each step produces evidence that an inspector or auditor can follow.

Process step	What it requires
Risk management plan	Define scope, responsibilities, risk acceptability criteria and how production and post production data will be reviewed.
Risk analysis	Identify the intended use and reasonably foreseeable misuse, and identify every known and foreseeable hazard.
Risk evaluation	Estimate the probability and severity of harm for each hazardous situation and compare against the acceptability criteria.
Risk control	Reduce risk through safe design first, then protective measures, then information for safety, and verify each control works.
Residual and overall risk	Evaluate residual risk for each hazard and whether overall benefit outweighs overall risk.
Risk management review	Confirm the plan was followed and the file is complete before release, recorded in a risk management report.
Production and post production	Collect and review manufacturing, complaint, service and field data, and update the file when the risk picture changes.

What the Olympus Warning Letter Found

FDA inspected six Olympus sites in late 2025 and issued a warning letter dated 7 October 2026. The findings span design validation, nonconforming product, process validation, CAPA, complaint handling and medical device reporting. Several of them trace directly back to a risk management file that did not do its job. The table below maps the most relevant findings to the risk management lesson behind them.

Olympus finding	What happened	Risk management lesson
UHI-4 insufflator	The risk management report did not reflect identified catastrophic hazards, and validation did not simulate pressure sensor failure or worst case use.	Every identified hazard must flow into risk controls and into design validation.
Sphincterotome	Risk documents omitted a higher severity hazard of unintended vessel cutting and bleeding.	Severity must be assessed honestly, because understating it hides unacceptable risk.
Cystoscope and bronchoscope	Instructions for use claimed laser compatibility that was never validated, including one claim behind a Class I recall for combustion risk.	Intended use and every labelling claim are inputs to the risk analysis and must be validated.
Complaint trending	Known defects from 2018 to 2021 and thousands of complaints drew no timely CAPA or risk update.	Production and post production data must feed back into the risk file.

FDA cited these issues under the former Quality System Regulation, including the design validation requirement at 21 CFR 820.30(g), because the inspections predate the new rule. Corrective actions must now meet the Quality Management System Regulation, which took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference. The risk management expectations did not soften in the transition. If anything, aligning to ISO 13485 and ISO 14971 makes them more explicit.

When Identified Hazards Never Reach the Risk File

The most damaging risk management failure is not an unknown hazard. It is a known hazard that is identified somewhere in the organization and then never carried into the risk file, the risk controls or the design validation. Olympus provides three clear examples, and each one maps to a different gap in the ISO 14971 process.

Catastrophic hazards left uncontrolled

For the UHI-4 insufflator, FDA found that the risk management report did not reflect identified hazards, even though catastrophic outcomes including air embolism, arrhythmia and patient death had been identified. Validation did not simulate pressure sensor failure or worst case use. Under ISO 14971, every identified hazard must be carried into risk estimation and risk control, and the controls must be verified under realistic conditions. A hazard that is named but not controlled is the definition of an incomplete risk file.

Understated severity

For a sphincterotome, the risk documents omitted a higher severity hazard of unintended vessel cutting and bleeding. Severity is one half of the risk estimate, and understating it hides unacceptable risk. ISO 14971 requires an honest severity assessment for each hazardous situation, documented and justified. Quietly downgrading a severe outcome to keep a risk acceptable is exactly what auditors and inspectors look for.

Claims that outran the evidence

For a cystoscope and a bronchoscope, the instructions for use claimed compatibility with a laser fiber that was never validated. One of these led to a Class I recall for combustion risk. Intended use and every labelling claim are inputs to the risk analysis. If you claim a use, you must validate it and reflect it in the risk file. An unvalidated claim is both a design validation failure and a risk management failure.

Design Validation and Intended Use

Design validation confirms that the finished device meets user needs and intended uses under actual or simulated use conditions. It is where the risk file is tested against reality. The former 21 CFR 820.30(g) required validation under actual or simulated use, and ISO 13485 clause 7.3.7, now the governing requirement under the QMSR, carries the same expectation. Olympus failed this repeatedly, with validation that ignored worst case conditions, missing traceability matrices, and claims validated on the wrong equipment or not at all.

The practical lesson is to treat design validation and risk management as one loop. Each identified hazard should map to a design input, a risk control and a validation test that challenges the worst realistic condition. When that traceability is missing, a reviewer cannot confirm that the risk controls actually work, and neither can you. For how formal use related risk fits this picture, see our guide to FDA human factors submission categories.

Production and Post-Production Feedback Into Risk

ISO 14971 makes production and post production activities a formal part of risk management, not an afterthought. Manufacturers must actively collect and review complaints, service records, field data and trends, and update the risk file when new information changes the risk picture. Olympus was cited for the opposite. Pressure sensor defects were known from 2018 to 2021 with no CAPA opened until FDA asked. One grip device drew more than 1,900 complaints, most of them reportable, and the health hazard evaluation was cancelled, with a recall following more than a year later.

This is where risk management and the CAPA system meet. Complaint trending that excludes most complaints, or control limits set years ago and never reassessed, will not detect a rising risk. The risk file then stays frozen while the real world risk climbs. Our analysis of why CAPA keeps failing goes deeper on the root cause gap, and the Olympus CAPA governance piece covers the multi site oversight failures in detail.

ISO 14971, ISO 13485 and the QMSR

These three frameworks are not competing. ISO 14971 is the risk management standard. ISO 13485 is the quality management system standard, and it requires risk management across the product realization process, pointing to ISO 14971 for the method. The FDA Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016 by reference, so risk management is now embedded in the United States device quality system as well. FDA separately recognizes ISO 14971:2019 as a consensus standard, and ISO/TR 24971 provides guidance on applying it.

For manufacturers, the message is simple. A risk management file built to ISO 14971:2019 supports FDA, Health Canada and European requirements at once. Building three separate risk stories for three markets is both wasteful and risky. For the broader transition to the new rule, see our guide to the FDA QMSR and ISO 13485 for device makers.

What This Means for Canadian Device Makers

Health Canada requires risk management too. The Medical Devices Regulations (SOR/98-282) set safety and effectiveness requirements that a manufacturer must demonstrate, and ISO 13485:2016 certification is mandatory for most licence classes through the Medical Device Single Audit Program. A Class III or Class IV licence application must show that risks were identified, controlled and verified. A thin or outdated risk file is a common reason applications stall and a common inspection finding.

Canadian manufacturers and importers should also remember that risk management does not end at market entry. Mandatory problem reporting and recall obligations under SOR/98-282 depend on the same post market vigilance that ISO 14971 requires. If your complaint and field data do not feed your risk file, you will miss both the risk update and the reporting trigger.

ISO 14971 Risk File Compliance Checklist

Use this checklist to test whether your risk management file would survive an FDA inspection or a notified body audit.

A current risk management plan defines scope, responsibilities and risk acceptability criteria.
Intended use and reasonably foreseeable misuse are documented and drive the hazard analysis.
Every identified hazard is traceable to a risk control and to verification that the control works.
Severity and probability are assessed honestly and justified, with no quiet downgrades.
Design validation challenges worst case and failure conditions, not only nominal use.
Every labelling and instructions for use claim, including compatibility claims, is validated and reflected in the risk file.
A traceability matrix links hazards, design inputs, controls, verification and validation.
Residual risk and overall benefit-risk are evaluated and documented.
A risk management report confirms the plan was followed before release.
Complaints, service records and field data are trended and fed back into the risk file.
CAPA and risk management are connected, so a rising trend triggers both a CAPA and a risk update.
The file is maintained to ISO 14971:2019 and aligned with ISO 13485 and the QMSR.

Common Mistakes

Treating the risk file as a one time document for the submission, then never updating it.
Identifying a hazard in one function, such as service or complaints, without feeding it into the risk file.
Validating design under nominal conditions only, ignoring foreseeable worst case and failure modes.
Making labelling or compatibility claims that were never validated.
Trending only reportable complaints, so most of the signal is invisible.
Downgrading severity to keep a risk acceptable instead of adding real controls.
Keeping risk management and CAPA in separate silos that never talk to each other.

Frequently Asked Questions

What is ISO 14971 and is it current?

ISO 14971:2019 is the international standard for applying risk management to medical devices. It is the current edition, confirmed on review in 2025, and FDA recognizes it as a consensus standard. ISO/TR 24971 provides guidance on applying it.

Does the FDA QMSR change risk management requirements?

The Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016 by reference. ISO 13485 requires risk management across product realization and points to ISO 14971 for the method, so risk management is now embedded in the United States device quality system.

Did the Olympus warning letter cite ISO 14971 directly?

No. FDA cited the Quality System Regulation in force at inspection, including design validation at 21 CFR 820.30(g) and the CAPA and complaint requirements. The findings describe risk management failures, such as identified hazards that were not controlled, which ISO 14971 is designed to prevent.

Is risk management required in Canada?

Yes. The Medical Devices Regulations (SOR/98-282) set safety and effectiveness requirements, and ISO 13485:2016 certification through the Medical Device Single Audit Program is mandatory for most licence classes. A Class III or IV application must show risks were identified, controlled and verified.

What is the difference between a risk analysis and a risk management file?

A risk analysis identifies hazards and estimates risk. The risk management file is the complete record of the whole process, including the plan, analysis, evaluation, controls, verification, the risk management report, and production and post production data. The analysis is one input to the file.

How does post market data fit into risk management?

ISO 14971 requires manufacturers to collect and review production and post production information, including complaints and field data, and to update the risk file when new information changes the risk. A complaint trend that signals a new or higher risk should trigger both a CAPA and a risk management update.

How MFLRC Can Help

MF License and Regulatory Consultants helps medical device manufacturers and importers build risk management files that hold up under FDA, Health Canada and notified body scrutiny. Our work includes ISO 14971 risk file development and remediation, gap assessments against the QMSR and ISO 13485, design validation and traceability review, linking CAPA and complaint trending back into risk, and support for Class III and IV licence applications. When a warning letter or Form 483 has already landed, we help structure the response and the corrective action that regulators expect, and we coach teams on how to respond to an FDA Form 483 or Health Canada inspection.

If your risk management file has not kept pace with your complaints, your design changes or the new QMSR, a focused review will show you where the gaps are before an inspector does. Book an ISO 14971 risk file review with MFLRC.

Book an ISO 14971 Risk File Review

Conclusion

The Olympus warning letter is a reminder that risk management fails quietly. Hazards get identified and then stranded, severity gets understated, claims outrun the evidence, and complaint data never circles back. ISO 14971 is the discipline that keeps the thread intact, from intended use to hazard to control to verification to post market feedback. Build the file as a living record, connect it to design validation and CAPA, and it becomes the strongest evidence you have that your device is safe and effective.